YunoHost-Apps sogo_yhn: Authentication bypass in HTTP Basic authentication
Summary
The YunoHost package sogo_yhn configures SOGo with SOGoTrustProxyAuthentication set to YES, which causes SOGo to skip password validation during HTTP Basic authentication. An unauthenticated attacker who knows a valid username can log in to that user's account with any password. Successful logins would give access to mailboxes, calendars and contacts of the affected account.
Affected
- YunoHost-Apps sogo_yhn, all versions before 5.8.0~ynh9
- Default configuration: unaffected (according to the CVE record)
Fixed in
- Fixed in sogo_yhn 5.8.0~ynh9
Workaround
- Unknown. No workaround is documented in the available sources.
- Check whether SOGoTrustProxyAuthentication is set to YES in /etc/sogo/sogo.conf and disable it manually as a temporary measure, after verifying the impact on SSO.
Exploitation
- Exploited in the wild: no evidence found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: none found.
- CVSS 4.0 base score 9.2 (CRITICAL), attack complexity rated High.
Our recommendation
- Upgrade sogo_yhn to 5.8.0~ynh9 as soon as possible. This fix also addresses CVE-2026-74864.
- Prioritise internet-facing SOGo instances on YunoHost.
- Review logs for logins that succeeded without a valid password; the sources do not describe specific log signatures.
- Restart the server after the update.
- Systems on YunoHost 11 cannot install the fixed version directly, so plan an upgrade to a supported release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in YunoHost-Apps sogo_yhn software cert.pl
- YunoHost Forum: SOGo critical vulnerability fixed in 5.8.0~ynh9 forum.yunohost.org
- OpenCVE: sogo_yhn CVEs app.opencve.io
- SOGo Installation Guide www.sogo.nu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:04.
Original description (NVD)
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.